You are viewing an old version of this page. View the current version.
Compare with Current
View Page History
« Previous
Version 19
Next »
Status at a glance:
Scalar Crypto Specification:
Lightweight instruction set extensions for RV32 and RV64 HARTs. Proposed extensions:
- Extensions fully defined in the Scalar Crypto Specification: K, Zkn, Zks, Zkr, Zkne, Zknd, Zknh, Zksed, Zksh
- Shared with the Bit-Manipulation Specification: Zkg, Zkb
Specification
- Draft Scalar Crypto Specification (v0.8.1)
- Stable
- What's next:
- Needs translation into ASCIIDOC
- Incorporate results of OpCode consistency review, once available
- Need to discuss removing gorci
- Roadmap:
- Version v0.9.0 will include any feedback from opcode consistency review, plus any small cleanups and editorial work.
- No functional changes to instruction or entropy source behaviour are expected.
- Exact encodings may be changed for the better.
- v0.9.0 will likely be the public review version.
Encoding/OpCode consistency review
- Opcodes and encodings proposed
- Instruction extensions (instruction groupings) proposed
- Submitted to review task group
- The Bit-Manipulation shared subsets are being reviewed first as part of Bit-Manipulation specification review
- Proposed as Zkg (clmul) and Zkb (specific crypto-required bit-manipulation commands)
- The Proposed Scalar Crypto-unique subsets are next in line for review:
- K (Krypto):
- Zkn (full NIST Suite): ZKne (NIST encrypt suite), ZKnd (NIST decrypt suite), ZKnh (NIST hash suite), Zkg, Zkb (see above)
- Zkr (random entropy source)
- Zks (full ShangMi Suite): Zksed (SM4 encrypt/decrypt suite), Zksh (SM3 hash suite), Zkg, Zkb (see above)
Architecture Tests
- Test plan for the scalar-crypto specific instructions is available.
- No actual tests suitable for use currently available. An old experimental set need removing from the riscv-crypto repository, as these no longer work with the latest toolchain or architectural test framework.
- What's next:
- Imperas have a complete set of tests, written to the existing test plan, for the scalar crypto instructions and the bitmanip instructions we borrow.
- These tests will be contributed upstream to the riscv-arch-test repository imminently, with many thanks to Imperas.
- They form a base we can use to develop prototype implementations / Spike / SAIL / QEMU very easily and quickly.
- IIT Madras are also looking at writing the scalar crypto tests for integration into the official architectural tests repo as well.
- Meeting on Wednesday 24th Feb'21 to discuss this.
- Likely path is that they re-implement the tests as part of the blessed coverage and test generation tooling.
- We then switch over to using the IIT tests when they are finished, since they will be easier to maintain/extend going forward than the Imperas tests.
GCC and Assembler
- Experimental / development toolchain available in the riscv-crypto repository.
- This cannot be up-streamed, but can be used for development work for now.
- Up-streamable support is WiP with PQShield.
- Progress so far:
- Intrinsics proposal from Markku
LLVM
- Work will be done by PLTC lab under the group contributor model.
- Looks like the work is just getting started.
- Need to set up a meeting.
Simulators
Though all listed under "simulators", these are actually a collection of formal model / virtual machine / architectural simulators / DV simulators etc.
SAIL
- Currently working on getting support merged in upstream in PR#80
Spike
- Upstream support has been merged in as of PR#635
- Support for all of scalar crypto specific instructions and entropy source.
- The only feature left is to enable the right Bitmanip instructions when K is enabled. Currently, one must include "b" in the spike "–isa=" argument.
- Some pending bug fixes in PR#649
riscvOVPSimPlus
- Imperas Commercial Simulator
- Freeware version
- Support for:
- Crypto-scalar v0.7.2, v0.81 + Bitmanip subsets
- Bitmanip 0.92, 0.93
- Functional coverage collection.
QEMU
- No work started yet.
- Work will be done by PLTC lab under the group contributor model.
Proof-of-Concept implementations
Hardware
Project Name | Base Architecture | Level of implementation | Notes |
---|
scarv-cpu | RV32 | Behavioural RTL simulation / Yosys Synthesis / FPGA | Completely Public/Open Source. Useful as a public baseline. Commercial implementations should aim to be better than this! |
PQShield security core | RV32 | (assumed) Behavioural RTL simulation. Running on FPGA. | Closed / commercial source. Most complete implementation of the entropy source. |
Romain Dolbeau / VexRISC-V | RV32 | Running on FPGA. | Uses VexRiscv core as a base. Completely independent implementation from scratch, outside the Crypto TG. |
- We still need RV64 implementations.
- Barry Spinney has offered to do advanced node synthesis runs for open source implementations.
- I (Ben) intend to take him up on this when I get time. No idea when that will be.
Software
Project/Maintainer | Description |
---|
Romain Dolbeau | Independent implementations of various important ciphers + modes of operation. |
rvkrypto-fips / Markku | "FIPS 140-3 and higher-level algorithm Tests for RISC-V Crypto Extension" |
riscv-crypto benchmarks | Initial benchmarks used to develop the scalar crypto extension. |
ABI Extensions